Sun Solaris 10.0 TCP Fusion tcp_fuse_rcv_drain Loopback Connection null pointer dereference
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.7 | $0-$5k | 0.00 |
Summary
A vulnerability classified as problematic has been found in Sun Solaris 10.0. Affected is the function tcp_fuse_rcv_drain of the component TCP Fusion. This manipulation as part of Loopback Connection causes null pointer dereference.
This vulnerability is tracked as CVE-2006-5396. No exploit exists.
It is suggested to install a patch to address this issue.
Details
A vulnerability was found in Sun Solaris 10.0 (Operating System). It has been declared as problematic. Affected by this vulnerability is the function tcp_fuse_rcv_drain of the component TCP Fusion. The manipulation as part of a Loopback Connection leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:
The tcp_fuse_rcv_drain function in the Sun Solaris 10 kernel before 20061017, when TCP Fusion is enabled, allows local users to cause a denial of service (system crash) via a TCP loopback connection with both endpoints on the same system.
The bug was discovered 10/17/2006. The weakness was disclosed 10/18/2006 with Sun Microsystems Inc. (Website). The advisory is shared at sunsolve.sun.com. This vulnerability is known as CVE-2006-5396 since 10/18/2006. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.
It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 518 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 21792 (Solaris 10 (sparc) : 118833-36 (deprecated)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Solaris Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 115438 (Sun Solaris TCP Fusion Local Denial of Service Vulnerability).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at sunsolve.sun.com. A possible mitigation has been published 4 months after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (29630), Tenable (21792), SecurityFocus (BID 20587†), OSVDB (29757†) and Secunia (SA22453†). The entries VDB-32667 and VDB-31922 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Vendor
Name
Version
License
Support
- end of life (old version)
Website
- Vendor: https://www.oracle.com/sun/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 5.7
VulDB Base Score: 6.5
VulDB Temp Score: 5.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Null pointer dereferenceCWE: CWE-476 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: Partially
Availability: 🔍
Status: Proof-of-Concept
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 21792
Nessus Name: Solaris 10 (sparc) : 118833-36 (deprecated)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: sunsolve.sun.com
Timeline
01/31/2005 🔍07/03/2006 🔍
10/17/2006 🔍
10/17/2006 🔍
10/17/2006 🔍
10/18/2006 🔍
10/18/2006 🔍
10/18/2006 🔍
10/18/2006 🔍
10/18/2006 🔍
10/20/2006 🔍
10/31/2006 🔍
01/29/2007 🔍
06/15/2025 🔍
Sources
Vendor: oracle.comAdvisory: sunsolve.sun.com⛔
Researcher: http://www.sun.com
Organization: Sun Microsystems Inc.
Status: Confirmed
CVE: CVE-2006-5396 (🔍)
GCVE (CVE): GCVE-0-2006-5396
GCVE (VulDB): GCVE-100-2617
OVAL: 🔍
X-Force: 29630 - Sun Solaris tcp_fuse_rcv_drain() denial of service, Medium Risk
SecurityFocus: 20587 - Sun Solaris TCP Fusion Local Denial of Service Vulnerability
Secunia: 22453 - Sun Solaris TCP Fusion Local Denial of Service, Not Critical
OSVDB: 29757 - Solaris TCP Fusion tcp_fuse_rcv_drain() Function Local DoS
SecurityTracker: 1017082
Vulnerability Center: 13000 - Sun Solaris 10 Kernel Local Denial of Service via TCP Loopback Connection, Medium
Vupen: ADV-2006-4080
See also: 🔍
Entry
Created: 10/20/2006 14:53Updated: 06/15/2025 22:13
Changes: 10/20/2006 14:53 (98), 07/10/2019 10:29 (2), 06/15/2025 22:13 (18)
Complete: 🔍
Cache ID: 216:58C:103
No comments yet. Languages: en.
Please log in to comment.